Query Libraries

Introduction

All of the queries provided may be used in the Logs Explorer, the Logging API, or the command-line interface, although this article focuses on the Logs Explorer.

The Logs Explorer specifies a subset of all log entries in your project using Boolean expressions. These searches can be used to select log items from specific logs or log services or to meet constraints on metadata or user-defined fields.

Sample queries using the Logs Explorer

Before you begin

To view the logs sent from an Amazon Web Services (AWS) account to Logging, use the Logs Explorer after selecting the AWS connector project in the Google Cloud console resource picker. The AWS connector project saves your Amazon Resource Name (ARN) and connects your AWS account to Google Cloud services.

To develop queries using Logs Explorer, ensure you have the appropriate Identity and Access Management permissions or roles.

Get started

To begin building queries with the console, go to Logs Explorer.

Choose the Cloud project or other Google Cloud resource for which you want to see logs.

Use the sample queries.

To use a query from one of the tables listed below, copy an expression, then paste the copied expression into the Logs Explorer query-editor field:

Source: Google Cloud

Enable Show query if you don't see the query-editor field.

After you've double-checked your query expression, click Run query. Under Query results, you'll see a list of logs that match your query. Some of the queries on this page contain variables that should be replaced with proper values. When a query contains logName, for example, the PROJECT_ID you specify must relate to the currently chosen Cloud project; otherwise, the query will fail.

Take note of the following:

• If you have a query with a timestamp, the time-range selector is disabled, and the query's time-range restriction is the timestamp expression. If a query does not employ a timestamp expression, the time-range selector is used as a time-range restriction.
   
• A query cannot be longer than 20,000 characters.
   
• Except for regular expressions, the Logging query language is case-insensitive.
   
• For queries using a log_name expression, use the log_id function. For instance, consider the expression.
  log_name="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access is the same as log_id("cloudaudit.googleapis.com/data_access")

The sections that follow categorize queries by Google Cloud services.

App Engine queries

The following table shows App Engine Queries and their respective expressions:

BigQuery queries

The following table shows BigQuery Queries and their respective expressions:

Dataflow queries

Dataproc queries

Cloud Deployment Manager

Cloud Functions queries

Identity and Access Management queries

Cloud Source Repositories queries

Cloud Spanner queries

Cloud SQL queries

Compute Engine queries

Cloud Storage queries

Cloud Tasks queries

Kubernetes-related queries

Cluster-level queries

Pod-level queries

Node-level queries

Namespace queries

Container queries

Logging agent application queries

Networking queries

Security logging queries

Google Cloud's operations suite queries